An attacker who has authorized local access to a Windows system can leverage the Projected File System component to read files or directories that should otherwise be protected. The vulnerability arises from improper handling of projected file paths, allowing the disclosure of information to users outside the intended scope. This leads to local information disclosure, potentially exposing sensitive data stored on the device or on network shares when projected into the local namespace.

The vulnerability affects Microsoft Windows 10 versions 1809, 21H2, and 22H2, and Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, including both x64 and arm64 architectures. It also impacts Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core). All affected releases rely on the Projected File System for sharing folders with file system applications.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score is not available, meaning the current available data does not estimate the exploitation probability. The CVE is not listed in CISA’s KEV catalog, so no known active exploits have been reported. The likely attack vector is local, requiring an attacker to have authorized access to the machine or a user running code that can interact with the Projected File System. If an attacker can manipulate the projected paths, they may read files that the user would not normally see.